{"id":2957,"date":"2010-09-30T11:31:15","date_gmt":"2010-09-30T10:31:15","guid":{"rendered":"https:\/\/www.darknet.org.uk\/?p=2957"},"modified":"2012-04-20T10:33:49","modified_gmt":"2012-04-20T09:33:49","slug":"inspathx-tool-for-finding-path-disclosure-vulnerabilities","status":"publish","type":"post","link":"https:\/\/www.darknet.org.uk\/2010\/09\/inspathx-tool-for-finding-path-disclosure-vulnerabilities\/","title":{"rendered":"inspathx – Tool For Finding Path Disclosure Vulnerabilities"},"content":{"rendered":"
inspathx is a tool that uses local source tree to make requests to the URL and searches for path inclusion (Full Path Disclosure<\/a>) error messages. It’s a very common problem in PHP web applications that crops up a lot. <\/p>\n PHP Web application developers sometimes fail to add safety checks against authentications, file inclusion etc and are prone to reveal possible sensitive information when those applications URLs are directly requested. Sometimes, it’s a clue to Local File Inclusion (LFI<\/a>) vulnerability. For open-source applications, source code can be downloaded and checked to find such information.<\/p>\n This script will do this job. <\/p>\n inspathx accepts the following arguments:<\/p>\n You can download inspathx via SVN here:<\/p>\n\n
\n
svn checkout http:\/\/inspathx.googlecode.com\/svn\/trunk\/ inspathx-read-only<\/pre>\n